# How does SafeNet MobilePASS generate passwords?

We use MobilePASS at work but the latest version of the android client seems to be buggy so I wanted to have a go at implementing the algorithm myself.

It looks to be based on the HMAC-SHA256 OTP algorithm. The client provides the user with the secret key when creating a new token which is copied into a web interface server side.

The bit I'm unsure about though is the pin. It looks like this is also included in the process but I'm having trouble determining exactly how.

Is there a standard way of extending HOTP to include a pin?

-

Yes, HOTP can include a PIN/Password also.

If you check RFC 4226, it says

Composite Shared Secrets

It may be desirable to include additional authentication factors in the shared secret K. These additional factors can consist of any
data known at the token but not easily obtained by others. Examples
of such data include:

  * PIN or Password obtained as user input at the token
* Phone number
* Any unique identifier programmatically available at the token


etc

And the HOTP Extensions document, also has a reference to this

In this case, the PIN/password value used to control the usage of
the token and/or protect access to the key embedded in the hardware
(or software) token can be injected in the Response computation, as
well as the random question Q:

Response = HOTP (K, Q|P)

Where | stands for concatenation.
etc


-
Cheers for the links. I tried both of the scheme of concatenating the key and the counter with a hash of the pin but that doesn't seem to match the output. To give you the data I have Key: MHQ34-F4XKC-NEHAU-JY2MG Pin: 1234 First Password: 372189 –  Dean Reilly Jul 12 '13 at 14:29